Container image signing and verification using AWS Signer for Amazon ECS and AWS Fargate

AWSTemplateFormatVersion: '2010-09-09'
Description: This template sets up infrastructure for a private, signed image

Resources:

  SigningProfile:
    Type: AWS::Signer::SigningProfile
    Properties:
      PlatformId: Notation-OCI-SHA384-ECDSA
      SignatureValidityPeriod:
        Type: YEARS
        Value: 3

  SignedContainerRegistry:
    Type: AWS::ECR::Repository
    Properties:
      EmptyOnDelete: True

  LambdaFunctionRegistory:
    Type: AWS::ECR::Repository
    Properties:
      EmptyOnDelete: True

Outputs:
  SignedRepositoryUri:
    Description: The URI to use for pushing signed container images
    Value: !GetAtt SignedContainerRegistry.RepositoryUri
  LambdaRepositoryUri:
    Description: The URI to use for pushing container images for lambda
    Value: !GetAtt LambdaFunctionRegistory.RepositoryUri
  SigningProfileArn:
    Description: An ARN referencing the signing profile
    Value: !GetAtt SigningProfile.Arn

AWSTemplateFormatVersion: "2010-09-09"
Transform: AWS::Serverless-2016-10-31
Description: Parent stack that deploys a sample workflow for signing and verifying
             the signatures on container images at runtime.

Resources:

  # The registry and AWS Signer setup
  RegistryStack:
    Type: AWS::Serverless::Application
    Properties:
      Location: registry.yml

Outputs:
  SignedRepositoryUri:
    Description: The URI to use for pushing container images to the private registry
    Value: !GetAtt RegistryStack.Outputs.SignedRepositoryUri
  LambdaRepositoryUri:
    Description: The URI to use for pushing container images for lambda
    Value: !GetAtt RegistryStack.Outputs.LambdaRepositoryUri
  SigningProfileArn:
    Description: An ARN referencing the signing profile
    Value: !GetAtt RegistryStack.Outputs.SigningProfileArn

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: This template sets up the verifier function

Parameters:
  LambdaImageUri:
    Description: The URI of the built container image (built outside of SAM because of buildkit)
    Type: String

Resources:

  VerifySignature:
    Type: AWS::Serverless::Function
    Properties:
      PackageType: Image
      ImageUri: !Ref LambdaImageUri
      MemorySize: 1024
      Environment:
        Variables:
          XDG_CONFIG_HOME: /var/task
      Policies:
        # Give the function access to Elastic Container Registry
        - Statement:
          - Sid: AllowEcrFetch
            Effect: Allow
            Action:
              - ecr:DescribeRepositories
              - ecr:DescribeImages
              - ecr:GetDownloadUrlForLayer
              - ecr:BatchGetImage
            Resource: !Sub 'arn:aws:ecr:${AWS::Region}:${AWS::AccountId}:repository/*'
          - Sid: AllowEcrAuth
            Effect: Allow
            Action:
              - ecr:GetAuthorizationToken
            Resource: '*'
          - Sid: AllowSigner
            Effect: Allow
            Action:
              - signer:GetRevocationStatus
            Resource: '*'
      Events:
        # Run on ECS task launch events
        ECSTaskCreateEvent:
          Type: EventBridgeRule
          Properties:
            Pattern:
              source:
              - aws.ecs
              detail-type:
              - ECS Task State Change
              detail:
                desiredStatus:
                - RUNNING
                lastStatus:
                - PROVISIONING

AWSTemplateFormatVersion: "2010-09-09"
Transform: AWS::Serverless-2016-10-31
Description: Parent stack that deploys a sample workflow for signing and verifying
             the signatures on container images at runtime.
Parameters:
  LambdaImageUri:
    Type: String

Resources:

  # The registry and AWS Signer setup
  RegistryStack:
    Type: AWS::Serverless::Application
    Properties:
      Location: registry.yml

  # The verification function
  VerificationFunction:
    Type: AWS::Serverless::Application
    Properties:
      Location: sigverify.yml
      Parameters:
        LambdaImageUri: !Ref LambdaImageUri

Outputs:
  SignedRepositoryUri:
    Description: The URI to use for pushing container images to the private registry
    Value: !GetAtt RegistryStack.Outputs.SignedRepositoryUri
  LambdaRepositoryUri:
    Description: The URI to use for pushing container images for lambda
    Value: !GetAtt RegistryStack.Outputs.LambdaRepositoryUri
  SigningProfileArn:
    Description: An ARN referencing the signing profile
    Value: !GetAtt RegistryStack.Outputs.SigningProfileArn

AWSTemplateFormatVersion: '2010-09-09'
Description: This template defines some sample workloads, signed and unsigned
Parameters:
  SignedImageUri:
    Type: String

Resources:
  # This role is used to setup the execution environment for the task,
  # including ability to download the image
  TaskExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service: [ecs-tasks.amazonaws.com]
            Action: ['sts:AssumeRole']
            Condition:
              ArnLike:
                aws:SourceArn: !Sub arn:aws:ecs:${AWS::Region}:${AWS::AccountId}:*
              StringEquals:
                aws:SourceAccount: !Ref AWS::AccountId
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy

  # This task definition is signed
  SignedTaskDefinition:
    Type: AWS::ECS::TaskDefinition
    Properties:
      Family: signed-task-def
      RequiresCompatibilities:
        - EC2
        - FARGATE
      ExecutionRoleArn: !GetAtt TaskExecutionRole.Arn
      NetworkMode: awsvpc
      Cpu: 256
      Memory: 512
      ContainerDefinitions:
        - Name: sample-signed
          Image: !Ref SignedImageUri

AWSTemplateFormatVersion: "2010-09-09"
Transform: AWS::Serverless-2016-10-31
Description: Parent stack that deploys a sample workflow for signing and verifying
             the signatures on container images at runtime.
Parameters:
  LambdaImageUri:
    Type: String
  SignedImageUri:
    Type: String

Resources:

  # The registry and AWS Signer setup
  RegistryStack:
    Type: AWS::Serverless::Application
    Properties:
      Location: registry.yml

  # The verification function
  VerificationFunction:
    Type: AWS::Serverless::Application
    Properties:
      Location: sigverify.yml
      Parameters:
        LambdaImageUri: !Ref LambdaImageUri

  # Sample task
  SampleTask:
    Type: AWS::Serverless::Application
    Properties:
      Location: sample-task.yml
      Parameters:
        SignedImageUri: !Ref SignedImageUri

Outputs:
  SignedRepositoryUri:
    Description: The URI to use for pushing container images to the private registry
    Value: !GetAtt RegistryStack.Outputs.SignedRepositoryUri
  LambdaRepositoryUri:
    Description: The URI to use for pushing container images for lambda
    Value: !GetAtt RegistryStack.Outputs.LambdaRepositoryUri
  SigningProfileArn:
    Description: An ARN referencing the signing profile
    Value: !GetAtt RegistryStack.Outputs.SigningProfileArn